GoogleOSV:CVE-2024-27982CVE-2024-27982
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.5 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%
The team has identified a critical vulnerability in the http server of the most recent version of Node, where malformed headers can lead to HTTP request smuggling. Specifically, if a space is placed before a content-length header, it is not interpreted correctly, enabling attackers to smuggle in a second request within the body of the first.
| CPE | Name | Operator | Version |
|---|---|---|---|
| nodejs | eq | 16.17.0-r0 | |
| nodejs | eq | 8.9.3-r1 | |
| nodejs | eq | 6.11.1-r0 | |
| nodejs | eq | 10.14.1-r0 | |
| nodejs | eq | 18.14.2-r1 | |
| nodejs | eq | 14.15.4-r0 | |
| nodejs | eq | 14.17.1-r0 | |
| nodejs | eq | 14.17.4-r0 | |
| nodejs | eq | 18.18.0-r0 | |
| nodejs | eq | 8.11.1-r1 |
References
Related
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
LOW
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.5 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
9.1%